node.js.yml

name: Node.js CI

on:
    push:
        branches: [master, main]
    pull_request:
        branches: [master, main]

# Least privilege for GITHUB_TOKEN. Without an explicit block a workflow inherits the
# repository default, which on many repos is read *and write* to everything -- flagged by
# CodeQL as actions/missing-workflow-permissions. This job only reads the checkout; the
# artifact upload authenticates with the runtime token, not GITHUB_TOKEN.
permissions:
    contents: read

jobs:
    build:
        runs-on: ubuntu-latest
        strategy:
            matrix:
                node-version: [20.x, 22.x]
        steps:
            - uses: actions/checkout@v7
            - name: Use Node.js ${{ matrix.node-version }}
              uses: actions/setup-node@v7
              with:
                  node-version: ${{ matrix.node-version }}
                  cache: npm
            - run: npm ci
            - run: npm run lint
            - run: npm run format:check
            - run: npm test
            - run: npm run coverage:check
            # Uploaded from one matrix leg only — the report is identical across them, and
            # two legs writing the same artifact name is an error. Makes a coverage
            # regression inspectable from the failing run instead of only reproducible locally.
            - name: Upload coverage report
              if: matrix.node-version == '22.x'
              uses: actions/upload-artifact@v7
              with:
                  name: coverage-report
                  # Only the readable report. `coverage/` also holds c8's raw V8 dump in
                  # tmp/, which is ~97% of the bytes and inspectable by nothing — 23 MB of
                  # tmp against a 647 kB report in the worst case here.
                  path: |
                      coverage/lcov-report
                      coverage/lcov.info
                  retention-days: 14